auth/cell_ref_admission.ts

The refusal message — byte-identical with the Rust spine's.

Refuse a write whose data introduces a fact ref the caller does not hold.

new_refs = derive_cell_refs(data) \ base, where base is what the write already carries — null on cell_create, the cell's current refs on cell_update, the source row's refs on each row cell_clone writes — so keeping refs someone else introduced, or cloning a viewable cell's refs, is admitted (the bytes were already readable through that cell). A global admin is not gated; a scoped admin is. The check runs on the write's transaction, only when new_refs is non-empty — a table probe, then one holder lookup for every new ref at once — and answers from holder rows only: an unheld hash reads the same whether or not a fact is stored under it.

A database without the fact chain (a consumer that mounts the cell verbs but no fact store) has no holders, so every new ref is refused there too — checked first, since naming a missing table would abort the transaction.

Runs as the last gate before the row is written: after the 404 masks, the per-kind validator, and the create authorizer.